Rockwell Automation FactoryTalk Historian ThingWorx
view advisory published 2025-05-22
Successful exploitation of this vulnerability could allow an attacker to launch XXE-based attacks on applications that accept malicious log4net configuration files.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-1285US | critical9.8 | Exploit | ||
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept a… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-142-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-25-142-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- Mitigation95057C-FTHTWXCT11
Rockwell Automation released a product update addressing this vulnerability:
- Fixed95057C-FTHTWXCT11
95057C-FTHTWXCT11: Versions v5.00.00 and later
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan